fix: xds translation return early, should be done in a best-effort ma…

…nner (envoyproxy#2202)

* fix: xds translation return early, should be done in a best-effort way instead

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add test for partial invalid resources

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

internal/xds/translator/runner/runner.go

@@ -81,6 +81,12 @@ func (r *Runner) subscribeAndTranslate(ctx context.Context) {
 				if err != nil {
 					r.Logger.Error(err, "failed to translate xds ir")
 					errChan <- err
+				}
+
+				// xDS translation is done in a best-effort manner, so the result
+				// may contain partial resources even if there are errors.
+				if result == nil {
+					r.Logger.Info("no xds resources to publish")
 					return
 				}
 

internal/xds/translator/runner/runner_test.go

@@ -156,8 +156,9 @@ func TestRunner_withExtensionManager(t *testing.T) {
 	xdsIR.Store("test", &res)
 	require.Eventually(t, func() bool {
 		out := xds.LoadAll()
-		// Ensure that xds has no key, value pairs
-		return len(out) == 0
+		// xDS translation is done in a best-effort manner, so event the extension
+		// manager returns an error, the xDS resources should still be created.
+		return len(out) == 1
 	}, time.Second*5, time.Millisecond*50)
 }
 

internal/xds/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml

@@ -0,0 +1,43 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  routes:
+  - name: "valid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "valid-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "invalid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "invalid-route-dest"
+      settings:
+      - endpoints:
+        - host: ""
+          port: 50000

internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml

@@ -0,0 +1,14 @@
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: valid-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: valid-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS

internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml

@@ -0,0 +1,12 @@
+- clusterName: valid-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: valid-route-dest/backend/0

internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml

@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        statPrefix: http
+        upgradeConfigs:
+        - upgradeType: websocket
+        useRemoteAddress: true
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml

@@ -0,0 +1,39 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: valid-route
+      route:
+        cluster: valid-route-dest
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: invalid-route
+      route:
+        cluster: invalid-route-dest